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Abstract.  We  propose  a  trust-threshold  based  routing  protocol  for  delay  tolerant 
networks,  leveraging  two  trust  thresholds  for  accepting  recommendations  and  for 
selecting  the  next  message  carrier  for  message  forwarding.  We  show  that  there 
exist  optimal  trust  threshold  values  under  which  trust-threshold  based  routing 
performs  the  best  in  terms  of  message  delivery  ratio,  message  delay  and  message 
overhead.  By  means  of  a  probability  model,  we  perform  a  comparative  analysis 
of  trust-threshold  based  routing  against  epidemic,  social-trust-based  and 
QoS-trust-based  routing.  Our  results  demonstrate  that  trust-threshold  based 
routing  operating  under  proper  trust  thresholds  can  effectively  trade  off  message 
delay  and  message  overhead  for  a  significant  gain  in  message  delivery  ratio. 
Moreover,  our  analysis  helps  identify  the  optimal  weight  setting  to  best  balance 
the  effect  of  social  vs.  QoS  trust  metrics  to  maximize  the  message  delivery  ratio 
without  compromising  message  delay  and/or  message  overhead  requirements. 

Keywords:  Delay  tolerant  networks,  encounter-based  routing,  trust  management, 
threshold-based  routing,  performance  analysis. 


1  Introduction 

Delay  Tolerant  Networks  (DTNs)  are  self-organizing  wireless  networks  with  the 
characteristics  of  large  latency,  intermittent  connectivity,  and  limited  resources  (e.g., 
battery,  computational  power,  bandwidth)  [1].  Different  from  traditional  networks 
such  as  mobile  ad  hoc  networks,  nodes  in  DTNs  forward  messages  to  a  destination 
node  in  a  store-and-forward  manner  [1]  in  order  to  cope  with  the  absence  of 
guaranteed  end-to-end  connectivity.  In  such  environments,  the  key  challenge  is  to 
select  an  appropriate  “next  message  carrier”  among  all  encountered  nodes  to 
maximize  message  delivery  ratio  while  minimizing  message  overhead  and  delay. 
Further,  we  face  additional  challenges  due  to  the  lack  of  a  centralized  trust  entity.  The 
open,  distributed,  and  dynamic  inherent  nature  of  DTNs  also  induces  security 
vulnerability  [2,  3].  In  this  paper,  we  consider  a  DTN  in  the  presence  of  malicious  and 
uncooperative  nodes  and  propose  a  method  for  the  selection  of  trustworthy  message 
carriers  with  the  goal  of  maximizing  message  delivery  ratio  without  compromising 
message  delay  or  message  overhead  in  the  context  of  DTN  routing. 
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Most  current  DTN  routing  protocols  are  based  on  encounter  patterns  [4,  5].  The 
problem  is  that  if  the  predicted  encounter  does  not  happen,  then  messages  would  be 
lost  for  single-copy  routing,  or  flooded  for  multi-copy  routing.  Moreover,  in  the 
presence  of  selfish  or  malicious  nodes,  these  approaches  still  could  not  guarantee 
reliable  message  delivery.  Several  recent  studies  [6-9]  used  reputation  to  select 
message  carriers  among  encountered  nodes  and  encouraged  cooperative  behaviors 
using  credit  incentives.  However,  a  centralized  credit  management  system  which  can 
be  a  single  point  of  failure  is  typically  required,  as  it  is  challenging  to  perform 
distributed  credit  management  in  a  DTN  in  the  presence  of  selfish  or  malicious  nodes. 
On  the  other  hand,  there  have  been  several  social  network  based  approaches  [10-14] 
to  select  the  best  message  carrier  in  DTNs.  They  considered  social  relationship  and 
social  networking  as  criteria  to  select  message  carriers  in  DTNs.  However,  no 
consideration  was  given  to  the  presence  of  malicious  or  selfish  nodes. 

This  work  extends  from  our  earlier  work  [15]  on  trust-based  routing  in  DTNs. 
Unlike  prior  work  cited  above  [4-14],  we  integrate  social  trust  and  Quality  of  Service 
(QoS)  trust  into  a  composite  trust  metric  for  determining  the  best  message  carrier 
among  new  encounters  for  message  forwarding.  In  this  work,  we  propose  the  design 
notion  of  trust  thresholds  for  determining  the  trustworthiness  of  a  node  acting  as  a 
recommender  or  as  the  next  message  carrier,  and  analyze  the  best  thresholds  under 
which  trust-threshold  based  routing  (TTBR)  in  DTNs  would  perform  the  best.  Our 
approach  is  distributed  in  nature  and  does  not  require  a  complicated  credit 
management  system.  Each  node  will  run  TTBR  autonomously  to  assess  trust  of  its 
peers  using  the  same  trust  threshold  setting  depending  on  application  characteristics, 
and  consequently  select  trustworthy  nodes  as  carriers  for  message  routing.  Without 
loss  of  generality,  we  consider  healthiness  and  cooperativeness  for  social  trust  to 
account  for  a  node’s  trustworthiness  for  message  delivery,  and  connectivity  and 
energy  for  QoS  trust  to  account  for  a  node’s  QoS  capability  to  quickly  deliver  the 
message  to  the  destination  node.  We  perform  a  comparative  analysis  of  TTBR  with 
epidemic  routing  [16],  social-trust-based  routing  (for  which  only  social  trust  metrics 
are  considered)  and  QoS-trust-based  routing  (for  which  only  QoS  trust  metrics  are 
considered)  and  identify  conditions  including  the  best  trust  thresholds  to  be  used 
under  which  trust-threshold  based  routing  outperforms  these  baseline  routing 
algorithms  for  a  DTN  consisting  of  heterogeneous  mobile  nodes. 


2  System  Model 

We  consider  a  DTN  environment  without  a  centralized  trust  authority.  Every  node 
may  have  a  different  level  of  energy  and  speed  reflecting  node  heterogeneity.  We 
differentiate  uncooperative  nodes  from  malicious  nodes.  An  uncooperative  node  acts 
to  maximize  its  own  benefit  regardless  of  the  global  benefit  of  the  DTN.  So  it  may 
drop  packets  arbitrarily  just  to  save  energy.  Once  a  node  becomes  uncooperative,  it 
stays  as  uncooperative.  A  malicious  node  acts  maliciously  with  the  intent  to  disrupt 
the  main  functionality  of  the  DTN,  so  it  can  drop  packets,  jam  wireless  channel,  and 
even  forge  packets.  As  soon  as  a  malicious  node  is  detected,  the  trust  value  of  the 
malicious  node  will  be  set  to  zero,  and  thus  excluding  it  as  a  message  carrier  for 
message  forwarding.  A  node  initially  may  be  healthy  but  become  compromised 
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because  of  being  captured,  for  example.  Once  a  node  is  compromised,  it  stays  as  a 
malicious  node. 

We  consider  the  following  energy  model.  The  energy  level  of  a  node  is  related  to 
its  social  encountering  activities.  If  a  node  becomes  uncooperative,  the  speed  of 
energy  consumption  by  the  node  is  slowed  down.  If  a  node  becomes  compromised, 
the  speed  of  energy  consumption  by  the  node  will  increase  since  the  node  may 
perform  attacks  which  may  consume  more  energy. 

A  node’s  trust  value  is  assessed  based  on  direct  observations  through  monitoring, 
snooping,  or  overhearing,  and  indirect  information.  To  counter  whitewashing  or  false 
information  attacks,  a  node  does  not  use  status  exchange  information  including 
encounter  history  information  because  a  malicious  node  can  provide  fake  encounter 
history  information  to  other  nodes  [17],  For  indirect  information,  a  node  uses 
recommendations  obtained  only  from  1-hop  neighbors  to  cope  with  fragile 
connectivity  and  sparse  node  density  in  DTNs.  The  trust  of  one  node  toward  another 
node  is  updated  upon  an  encounter  event.  Our  trust  metric  consists  of  two  aspects  of 
trust  relationship:  social  trust  and  QoS  trust.  Social  trust  is  based  on  social 
relationships.  We  consider  healthiness  and  cooperativeness  to  measure  the  social 
trust  level  of  a  node.  Social  network  structure-based  properties  such  as  similarity, 
centrality,  and  betweenness  are  not  considered  because  we  do  not  use  trust  encounter 
histories  exchanged  to  avoid  self-promoting  or  false  information  attacks  by  malicious 
nodes.  QoS  trust  is  evaluated  through  the  communication  networks  by  the  capability 
of  a  node  to  deliver  messages  to  the  destination  node.  We  consider  connectivity  and 
energy  to  measure  the  QoS  trust  level  of  a  node.  We  define  a  node’s  trust  level  as  a 
real  number  in  the  range  of  [0,  1],  with  1  indicating  complete  trust,  0.5  ignorance,  and 
0  complete  distrust. 


3  Trust- Threshold  Based  Routing 

Our  trust-threshold  based  routing  algorithm  builds  upon  the  notion  of  peer-to-peer 
trust  evaluation  at  runtime.  A  node  will  evaluate  its  peers  dynamically  and  will  use 
trust  thresholds  as  criteria  to  determine  if  it  can  trust  a  node  as  a  recommender  or  as  a 
message  carrier.  Two  trust  thresholds  are  used:  recommender  threshold  denoted  by 
Trec  and  message  forwarding  threshold  denoted  by  Tf-.  In  this  paper,  the  trust  value  of 
node  j  evaluated  by  node  i  at  time  t,  denoted  as  ;  is  computed  by  a  weighted 
average  of  healthiness,  cooperativeness,  connectivity,  and  energy  as  follows: 

7)  At)  =  w1Tllfalthiness (t)  +  w2Tcooperativeness(t)  +  w3 Tconnectivity  (t) 

+  wAT™eray{t) 

Here  w1(  w2,w3,  and  w4  are  weights  associated  with  healthiness,  cooperativeness, 
connectivity  and  energy,  respectively  with  w±  +  w2  +  w3  +  w4  =  1.  Specifically, 
node  i  will  update  its  trust  toward  node  j  upon  encountering  node  m  at  time  t  for  the 
duration  [t,  t  +  At]  as  follows: 

TfiQ  +  At)  =  P  xT^fect’x  (t  +  At)  +  P2Tijdirect'x(t  +  At)  (2) 
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Here  X  refers  to  a  trust  property.  In  Eq.  2,  /3j  is  a  parameter  to  weigh  node  V  s  own 
trust  assessment  toward  node  j  at  time  t  +  At,  and  /?2  is  another  parameter  to  weigh 
indirect  information  from  the  recommender.  Note  that  /?i  +  /?2  =  1. 


j,  direct.X 

li,j 


(t  +  At) 


(g-AdAt  x 


if  m  =  j 
if  m  ^  j 


(3) 


The  direct  trust  evaluation  of  node  j  is  given  in  Eq.  3  above  by  which  if  the  new 
encounter  (node  m )  is  node  j  itself,  then  node  i  can  directly  evaluate  node  j  because 
node  i  and  node  j  are  1-hop  neighbors.  We  use  T™lcounter'x  (t  +  At)  to  denote  the 
assessment  result  of  node  i  toward  node  m  in  trust  property  X  based  on  node  V  s  direct 
observations  toward  node  m  over  the  encounter  interval  [t,t  +  At].  Node  i  may  also 
leverage  its  past  experiences  with  node  m  over  [0,  t ]  to  help  assess  j.e^counter’x  (f  4. 
At),  especially  if  the  current  encountering  interval  is  short.  If  node  j  is  not  the  new 
encounter,  then  no  new  direct  information  can  be  gained  about  node  j.  So,  node  i  will 
use  its  past  trust  toward  node  j  obtained  at  time  t  decayed  over  the  time  interval  At  to 
model  trust  decay  over  time.  We  adopt  an  exponential  time  decay  factor,  e~AdAt 
(with  0  <  !,/<  0.1  to  limit  the  decay  to  at  most  50%).  Below  we  describe  how  node  i 
can  assess  Tie£counter,x (t  +  At)  based  on  direct  observations  during  its  encounter 
with  node  m  over  the  interval  [t,  t  +  At]: 


•  T°™ounter'healthlness(t  +  At):  This  provides  the  belief  of  node  i  that  node  m  is  not 
compromised  based  on  node  i’s  direct  observations  toward  node  in  over  the 
encounter  interval  [  t,  t  +  At  ].  Node  i  can  monitor  node  m’s  unhealthiness 
evidences  including  dishonest  trust  recommendation,  irregular  packet  patterns,  and 
abnormal  traffic  over  the  new  encounter  period  [t,  t  +  At]  or  even  extend  the  time 
period  to  [  0,  t  +  At  ]  to  help  assess  Tie£icounter,healthlness (t  +  At)  .  It  can  be 
computed  by  the  number  of  bad  experiences  in  healthiness  over  the  total 
healthiness  experiences. 

•  Tim  (t  +  At):  This  provides  the  degree  ol  node  ms 

cooperativeness  evaluated  by  node  i  based  on  direct  observations  over  the 
encounter  interval  [t,  t  +  At],  Node  i  can  apply  overhearing  and  snooping 
techniques  to  detect  cooperativeness  behavior,  e.g.,  whether  or  not  node  m  follows 
the  prescribed  hello  or  routing  protocol,  over  the  time  period  [t,  t  +  At]  or  even 
extend  the  time  period  to  [0,  t  +  At].  It  can  be  computed  by  the  number  of  bad 
experiences  in  cooperativeness  over  the  total  cooperativeness  experiences. 

•  T^ounter’connectwlty (t  +  At):  This  provides  the  connectivity  belief  that  node  m 
will  encounter  node  d  (a  node  which  may  become  a  destination  node  in  packet 
forwarding  in  the  future).  It  can  be  computed  by  the  number  of  encounters  between 
node  m  and  node  d  over  the  maximum  number  of  encounters  between  node  d  and 
any  other  node  over  the  time  period  [0,  t  +  At]  all  based  on  node  i's  observations. 
Note  that  node  i  can  observe  node  m  encountering  node  d  only  if  both  node  m  and 
node  d  are  within  1-hop  range  of  node  i.  Thus,  by  consulting  its  encounter  history 
with  all  nodes,  node  i  will  be  able  to  calculate  7’^e)"eounte,  ’connectlvlty  4  for 
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the  connectivity  of  node  m  to  node  d.  In  particular,  if  node  i  observes  that  node  d 
encounters  node  m  most  frequently  among  all  nodes  over  the  time  period  [0,  t  + 
At],  then  j^ounter'cnnnectlvlty  (£  4.  _  p  This  means  that  node  i  highly  trusts 

that  node  m  will  encounter  node  d  often  and  is  a  good  candidate  for  packet 
forwarding. 

•  T^ounter ’ener9y(t  +  At) :  This  provides  the  belief  of  node  i  toward  node  m’s 
energy  status  based  on  direct  observations  toward  node  m.  Here  energy  represents 
competence.  Node  i  can  monitor  node  m’s  transmission  signal  strength  over 
[t,  t  +  At]  to  estimate  energy  status  of  node  m. 

On  the  other  hand,  for  indirect  trust  evaluation,  only  1-hop  neighbors  of  node  i  will 
be  used  as  recommenders  for  scalability.  We  define  the  recommender  trust  threshold 
Trec  such  that  if  Tl  ;(t)  >  Trec,  node  i  will  consider  node  j  as  a  “trustworthy” 
recommender  at  time  t. 

The  indirect  trust  evaluation  toward  node  j  is  given  in  Eq.  4  below.  Rt  is  the  set 
containing  node  i’s  1-hop  neighbors  with  7)  c(t  +  At)  >  Trec  and  \R{  |  indicates  the 
cardinality  of  Rt  .  If  the  new  encounter  is  node  j,  then  there  is  no  indirect 
recommendation  available  for  node  j,  so  node  ;  will  use  its  past  trust  toward  node  j 
obtained  at  time  t  with  trust  decay  over  At.  If  the  new  encounter  is  not  node  j  and  node  i 
considers  node  c  as  a  trustworthy  recommender,  i.e.,  Tic(t  +  At)  >  Trec  then  node  c 
can  provide  its  recommendation  to  node  i  for  evaluating  node  j.  In  this  case,  node  i 
weighs  node  c’s  recommendation  with  node  i’s  trust  toward  node  c.  Moreover,  the  more 
recommendations  from  trustworthy  nodes  node  i  receives,  the  more  accurate  the  trust 
value  of  node  j  can  be.  Using  Trec  provides  robustness  against  bad-mouthing  or  good- 
mouthing  attacks  since  only  recommendations  from  trustworthy  nodes  are  considered. 


^indirect.  *(£  +  Af) 

fe~A«At  X  Ttxm(t), 
e-AdAt  x 

'LceRi{TiXc(.t  +  At)  x  T*j(t  +  At)} 
ZceRJudt  +  At) 


if  m  =  j 

if  m  ^  j  and  |R;|  =  0 
if  m  ^  j  and  |R;|  >0 


(4) 


When  node  i  encounters  node  m,  it  can  use  Ti  m(t)  to  decide  whether  or  not  node  m 
can  be  the  next  message  carrier  to  shorten  message  delay  or  improve  message  delivery 
ratio.  We  consider  a  Q-permissible  policy  with  7)  as  the  minimum  trust  threshold  for 
the  selection  of  the  next  message  carrier.  That  is,  node  i  will  forward  the  message  to 
node  m  if  Tim(t  +  At)  >  Tf  as  well  as  Tim(t )  is  in  the  top  Q  percentile  among  all 
Tjj(t)’s.  This  guarantees  to  select  a  trustworthy  next  message  carrier.  We  consider  only 
single-copy  message  routing,  and  buffer  management  is  not  considered  in  this  paper. 

4  Performance  Model 

We  develop  a  probability  model  to  analyze  the  performance  of  the  proposed  trust- 
threshold  based  routing  protocol  for  DTN  message  forwarding.  The  probability  model 
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T-COMPRO  t_uncooper 


Fig.  1.  SPN  Model 

is  based  on  stochastic  Petri  net  (SPN)  techniques  [18]  due  to  its  ability  to  handle  a 
large  number  of  states.  The  SPN  model  is  shown  in  Fig.  1  consisting  of  4  event 
subnets,  namely,  in  clockwise  order,  energy,  location,  cooperativeness,  and 
compromise.  The  purpose  of  the  SPN  model  is  to  yield  the  ground  truth  status  of  a 
node  (i.e.,  healthiness,  cooperativeness,  connectivity,  and  energy)  in  the  presence  of 
uncooperative  and  malicious  nodes  and  to  derive  its  trust  relationships  with  other 
nodes  in  the  system.  Without  loss  of  generality,  we  consider  a  square-shaped 
operational  area  consisting  of  mxm  sub-grid  areas  with  the  width  and  height  equal  to 
radio  range  R.  Initially  nodes  are  randomly  distributed  over  the  operational  area  based 
on  uniform  distribution.  Below  we  explain  how  we  construct  the  SPN  model  for 
describing  a  node’s  ground  truth  status. 

Location  ( Connectivity ):  We  use  the  location  subnet  to  describe  the  location  status  of 
a  node.  Transition  T_LOCATION  is  triggered  when  the  node  moves  to  a  randomly 
selected  area  out  of  four  different  directions  (i.e.,  north,  west,  south,  and  east)  from  its 
current  location  with  the  rate  a0/R  based  on  the  node’s  speed  <r0  and  radio  range  R. 
To  avoid  end-effects,  movement  is  bounced  back.  This  information  along  with  the 
location  information  of  other  nodes  at  time  t  provides  us  the  probability  of  two  nodes 
encountering  with  each  other  at  any  time  t. 

Energy.  We  use  the  energy  subnet  to  describe  the  energy  status  of  a  node.  Place 
ENERGY  represents  the  current  energy  level  of  a  node.  An  initial  energy  level  of  each 
node  is  assigned  according  to  node  heterogeneity  information.  A  token  is  taken  out 
when  transition  T_ENERGY  fires.  The  rate  of  transition  T_ENERGY  indicates  the 
energy  consumption  rate  which  depends  on  the  ground  truth  status  of  the  node  (i.e., 
uncooperativeness  and  healthiness). 

Healthiness:  We  use  the  compromise  subnet  to  describe  the  healthiness  status  of  a 
node.  A  node  becomes  compromised  when  transition  T_COMPRO  fires  and  then  a 
token  is  put  in  place  CN  to  represent  the  node  has  been  captured  and  compromised. 
The  rate  to  T_COMPRO  is  Acom,  the  per-node  compromising  rate  given  as  input  to 
the  SPN  model. 

Cooperativeness:  We  use  the  cooperative  subnet  to  describe  the  cooperative  status  of 
a  node.  Place  UCPN  indicates  whether  a  node  is  uncooperative  or  not.  If  a  node 
becomes  uncooperative,  a  token  goes  to  UCPN  by  triggering  T_UNCOOPER.  The 
transition  rate  to  T_UNCOOPER  is  Auncooper  the  per-node  uncooperative  rate  given 
as  input  to  the  SPN  model. 
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The  SPN  model  described  above  yields  the  “ground  truth”  status  of  each  node, 
which  facilitates  the  calculation  of  TXj  (t  +  At )  in  theoretical  analysis  as  follows. 
When  node  i  encounters  node  j,  node  i  will  assess  node  j  in  trust  property  X  to  yield 
T  encounter, x  q.  ^t).  Node  i  can  directly  observe  node  j  during  the  current  encounter 
interval  [t,  t  +  At]  plus  it  may  have  accumulated  past  direct  observations  toward  node 
j  over  [0,  t]  prior  to  the  current  encounter.  Thus,  assuming  that  the  “cooperativeness 
detection  mechanism”  described  earlier  in  the  protocol  design  is  effective,  node  i’s 
direct  assessment  on  node  j’s  cooperativeness  will  be  close  to  the  ground  truth 
cooperativeness  status  of  node  j  at  time  t  +  At.  Consequently, 
^encounter, cooperativeness  (t  +  ^  ^  gq  3  can  be  estimated  by  the  probability  that 

place  UCPN  in  node  j  does  not  contain  a  token  at  time  t  +  At.  Similarly,  node  i  can 
fairly  accurately  assess  Ti  j  ft)  by  consulting  its  encounter  history 

with  all  nodes  over  the  interval  [0,  t  +  At].  This  quantity  can  be  obtained  by  utilizing 
the  SPN  output  regarding  the  location  probability  of  nodes  j  and  d  at  time  t  +  At.  For 
the  healthiness  trust  component,  assuming  that  the  “healthiness  detection  mechanism” 
in  the  protocol  design  is  effective,  I]  j  ft  +  At)  can  be  approximated 

by  the  probability  that  place  CN  in  node  j  does  not  contain  any  token  at  time  t  +  At. 
Lastly,  node  i  can  observe  node  j’s  packet  transmission  signal  strength  over  [t,  t  + 
At]  to  estimate  T^counter’enel  9y {t  +  At),  which  will  be  close  to  the  ground  truth 
energy  status  of  node  j  and  can  be  obtained  from  the  SPN  output  by  inspecting  place 
ENERGY.  Note  that  we  predict  7'Lncounter,x(t  +  At)  for  theoretical  analysis.  In 
practice,  node  i  would  follow  the  protocol  design  to  assess  Tt  eJlcounter'  ft  +  At) . 
Once  TiePcounter'x (t  +  At)  is  obtained,  node  i  can  update  its  T^  ft  +  At)  based  on 
Eq.  2,  and  subsequently,  obtain  7^  y  ft  +  At)  based  on  Eq.  1. 

5  Results 

In  this  section,  we  show  numerical  results  and  provide  physical  interpretation  of  the 
results  obtained.  For  trust-threshold  based  routing  (TTBR),  we  set  w1:w2:w3:w4  = 
0.25:  0.25:  0.25:  0.25.  We  setup  20  nodes  with  vastly  different  initial  energy  levels 
(in  the  range  of  [12,  24]  hours)  in  the  system.  Each  node  moves  randomly  in  an  8x8 
operational  area  with  mobility  rate  being  er0  in  the  range  of  [  1,  4]  m/sec.  Each  of  the 
8x8  square  regions  is  of  the  same  size,  with  each  side  equal  to  R  =  250  in.  There  are 
three  types  of  nodes,  namely,  good,  uncooperative  and  malicious  nodes.  A  bad  node  is 
either  uncooperative  or  malicious,  or  both.  Good  nodes  have  zero  compromise  and 
uncooperative  rates.  Uncooperative  nodes  have  a  non-zero  uncooperative  rate  lUncooPer 
(i.e.,  once  per  300  sec).  Malicious  nodes  have  a  non-zero  compromise  rate  Acorn  in 
the  range  of  [l/480min.,  l/160min.].  We  set  /?y.-/L=0.8:0.2  to  put  high  trust  on  direct 
observations  over  indirect  recommendations.  The  initial  trust  level  is  set  to  ignorance 
(i.e.,  0.5)  for  all  trust  components  due  to  no  prior  interactions  among  nodes.  We  set 
the  decay  coefficient  Ad  =  0.001,  and  the  average  encounter  interval  At  =5  min, 
resulting  in  e~Ad&t  =  0.995  to  model  small  trust  decay  over  time. 
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We  consider  a  message  forwarding  case  that  a  pair  of  source  and  destination  nodes 
is  picked  randomly  among  good  nodes  in  each  run.  We  allow  30  min  warm-up  time 
for  nodes  to  accumulate  experiences  about  each  other  and  start  a  message  forwarding 
afterwards  in  each  run.  If  a  message  carrier  is  malicious,  the  message  is  dropped  (a 
weak  attack).  If  the  message  carrier  is  uncooperative,  the  message  delivery  continues 
with  50%  chance.  The  message  delivery  run  is  completed  when  the  message  is 
delivered  to  the  destination  node,  or  the  message  is  lost  before  it  reaches  the 
destination  node.  Data  are  collected  for  2000  runs  from  which  the  message  delivery 
ratio,  delay  and  overhead  performance  measurements  are  calculated.  Here,  the 
message  overhead  is  measured  by  the  number  of  copies  forwarded  to  reach  the 
destination  node.  For  the  message  delay  and  the  message  overhead,  we  only  consider 
messages  that  are  delivered  successfully. 


(Tf=0.6,  Trec=0.6) 
(Tf=0.6,  Trec=0.7) 
(Tf=0.6,Trec=0.8) 
(Tf=0.6,  Trec=0.9) 
(Tf=0.7,  Trec=0.6) 
(Tf=0.7,  Trec=0.7) 
(Tf=0.7,  Trec=0.8) 
(Tf=0.7,  Trec=0.9) 
(Tf=0.8,  Trec=0.6) 
(Tf=0.8,  Trec=0.7) 
(Tf=0.8,Trec=0.8) 
(Tf=0.8,Trec=0.9) 
(Tf=0.9,  Trec=0.6) 
(Tf=0.9,  Trec=0.7) 
(Tf=0.9,Trec=0.8) 
(Tf=0.9,  Trec=0.9) 


Fig.  2.  Effect  of  Tf  and  Trec  on  Message  Delivery  Ratio 


First  of  all,  we  investigate  the  optimal  values  of  Trec  and  Tf  under  TTBR  in  DTNs. 
From  Figs.  2-3,  we  see  that  7}  =  0.9  consistently  performs  better  than  the  others  in 
terms  of  all  performance  metrics  over  a  wide  range  of  bad  node  population.  This  is 
because  with  Tf  —  0.9,  TTBR  behaves  like  a  “direct  delivery”  approach  with  very  little 
copies  being  passed  around  to  intermediate  message  carriers,  resulting  in  a  more  direct 
route  to  the  destination  node.  More  specifically,  as  the  percentage  of  bad  nodes 
increases,  there  may  be  an  extreme  case  where  node  i  stores  a  message  and  delivers  it 
directly  to  the  destination  node  because  it  could  not  encounter  any  node  with  trust 
higher  than  Tf.  This  is  true  in  our  DTN  scenario  where  nodes  can  encounter  each  other 
with  nonzero  probability  due  to  random  movement.  In  situations  where  a  node’s 
movement  is  not  random  and  the  encountering  probability  may  be  zero  or  very  small 
among  certain  nodes,  Tf  —  0.9  may  not  necessarily  always  perform  the  best.  Our  model 
helps  identify  the  best  Tf  that  minimizes  the  message  delay/overhead.  From  Fig.  4,  we 
see  that  Trec  —  0.6  has  the  shortest  message  delay  and  the  lowest  message  overhead 
over  a  wide  range  of  the  percentage  of  bad  nodes  when  Tf  is  fixed  at  0.9.  The  reason  is 
that  the  recommenders  are  all  good  nodes  when  0.6  <  Trec  <  0.9  and  Trec  —  0.6  not 
only  allows  more  recommenders  but  also  provides  sufficiently  correct 
recommendations,  resulting  in  a  more  accurate  indirect  trust  assessment  based  on  Eq.  4. 
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In  summary,  we  conclude  that  there  can  exist  optimal  Tf  and  Trecm  TTBR  to  best 
tradeoff  message  delivery  ratio,  message  delay,  and  message  overhead,  adapting  to 
application  or  network  environmental  conditions. 


Tf=0.6  ■Tf=0.7  ■  Tf=0.8  ■Tf=0.9 
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Fig.  3.  Effect  of  7}  on  Message  Delay  and  Message  Overhead  (' Trec  =  0.6) 
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Fig.  4.  Effect  of  Trec  on  Message  Delay  and  Message  Overhead  (Tf  =  0.9) 

We  also  perform  a  comparative  analysis  of  TTBR  against  epidemic  routing,  social- 
trust-based  routing  (STBR),  and  QoS-trust-based  routing  (QTBR).  For  STBR  and 
QTBR,  we  set  w2:  w3:  w4  =  0.5:  0.5:  0:  0  and  0:  0:  0.5:  0.5,  respectively.  Note 
that  STBR  and  QTBR  are  special  cases  of  TTBR,  with  STBR  using  only  social  trust 
metrics  and  QTBR  using  only  QoS  trust  metrics  for  trust  evaluation.  Thus,  the  design 
concept  of  trust  thresholds  also  applies  to  them.  To  show  the  effect  of  Tf,  we  evaluate 
the  performance  of  these  two  routing  algorithms  with  and  without  Tf. 

Fig.  5  shows  that  the  routing  protocols  with  Tf  outperform  those  without  Tf  in  the 
delivery  ratio.  Also,  TTBR  with  Tf  and  STBR  with  Tf  perform  better  than  QTBR 
with  Tf  and  epidemic  routing  with  delivery  ratio  approaching  1  over  a  wide  range  of 
bad  node  population.  This  is  because  TTBR  and  STBR  are  able  to  differentiate 
trustworthy  nodes  from  bad  nodes  and  select  trustworthy  nodes  to  relay  the  message. 
We  also  note  that  performance  of  epidemic  routing  deteriorates  when  there  is  a  high 
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bad  node  population  because  it  does  not  select  trustworthy  message  carriers.  This 
result  demonstrates  the  effectiveness  of  incorporating  social  trust  into  the  decision 
making  process  for  DTN  message  routing,  as  well  as  using  7)  to  select  the  next 
message  carrier  to  yield  high  delivery  ratio. 


♦  TTBR  (with  Tf  )  - • - QTBR  (with  Tf  )  - * - STBR  (with  Tf  ) 

- X TTBR  (w/o  Tf)  - *  —  QTBR  (w/o  Tf  )  - • STBR  (w/o  Tf  ) 

I  Epidemic 


0  10  20  30  40  50  60  70  80  90 

%  of  malicious  and  uncooperative  nodes 

Fig.  5.  Message  Delivery  Ratio  ( Trec  =  0.6,  Tf  =  0.9) 

Fig.  6  shows  that  all  routing  algorithms  without  Tf  approach  the  ideal  performance 
obtainable  from  epidemisc  routing  as  the  percentage  of  bad  nodes  increases.  This  is 
because  the  probability  of  being  able  to  forward  the  message  to  a  good  node  decreases 
as  more  bad  nodes  exist  in  the  system.  Fig.  7  shows  that  all  trust-based  routing 
algorithms,  with  or  without  Tf,  outperform  epidemic  routing  considerably  in  message 
overhead  because  trust  is  being  utilized  to  regulate  message  forwarding. 

♦  TTBR  (with  Tf  )  - • QTBR  (with  Tf )  * STBR  (with  Tf  ) 

--X-- TTBR  (w/o  Tf)  QTBR  (w/o  Tf) • — STBR(w/oTf) 

I  Epidemic 


8 


0  10  20  30  40  50  60  70  80  90 

%  of  malicious  and  uncooperative  nodes 

Fig.  6.  Message  Delay  ( Trec  =  0.6,  Tf  =  0.9) 

In  Figs.  6-7,  QTBR  performs  better  than  TTBR  and  STBR  in  terms  of  message 
delay  and  message  overhead.  This  is  because  the  path  selected  by  TTBR  or  STBR 
may  not  be  the  most  direct  route  as  they  attempt  to  avoid  bad  nodes  when  compared 
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with  QTBR  that  only  uses  the  connectivity  metric  and  the  residual  energy  metric  as 
the  criteria  to  select  a  message  carrier.  This  result  indicates  that  if  the  objective  is  to 
minimize  message  delay  or  message  overhead,  we  should  set  the  weights  associated 
with  connectivity  and  energy  considerably  higher  than  those  for  healthiness  and 
cooperativeness  for  TTBR  to  approach  the  performance  of  QTBR  in  message  delay  or 
message  overhead. 


♦  TTBR  (with  Tf  ) 

- X--TTBR  (w/o  Tf) 
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- ■ - QTBR  (with  Tf ) 
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Fig.  7.  Number  of  Copies  Propagated  per  Message  ( Trec  =  0.6,  Tf  =  0.9) 


In  summary,  from  Figs.  5-7,  we  see  that  our  proposed  trust-threshold  based  routing 
algorithm  operating  under  identified  optimal  Tf  values  can  effectively  trade  off 
message  overhead  and  message  delay  for  a  significant  gain  in  message  delivery  ratio. 
Moreover,  our  analysis  results  reveal  that  there  exists  an  optimal  weight  setting  in 
terms  of  wt :  w2 :  w3 :  w4  (e.g.,  STBR  vs.  QTBR  vs.  TTBR)  to  best  balance  the  effect  of 
social  trust  metrics  vs.  QoS  trust  metrics  to  maximize  the  delivery  ratio  without 
compromising  message  delay  and/or  message  overhead  requirements. 


6  Conclusion 

We  have  proposed  and  analyzed  a  trust-threshold  based  routing  algorithm  with  the 
design  objective  to  maximize  the  message  delivery  ratio  while  satisfying  the  message 
delay  and  message  overhead  requirements.  Our  algorithm  leverages  a  trust 
management  protocol  incorporating  both  social  and  QoS  trust  metrics  for  peer-to-peer 
trust  evaluation,  as  well  as  trust  thresholds  for  selecting  recommenders  for  indirect 
trust  evaluation  and  for  selecting  the  next  message  carrier  for  message  forwarding. 
Our  performance  analysis  results  demonstrate  that  when  operating  under  proper  trust 
thresholds  and  social  vs.  QoS  trust  weight  settings  as  identified  in  the  paper,  TTBR 
can  effectively  trade  off  message  delay  and  message  overhead  for  a  significant  gain  in 
message  delivery  ratio  to  achieve  the  design  objective.  In  the  future  we  plan  to 
perform  a  more  comprehensive  comparative  analysis  with  existing  trust  management 
protocols  for  DTN  routing.  We  also  plan  to  address  quality  assurance  of  subjective 
trust  evaluation  by  extensive  theoretical  and  experimental  validation  with  trace  data. 
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